CVE-2025-53941CWE-79

Hollo renders posts received with form elements and allows submission

Medium · published July 17, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be submitted, making the software vulnerable to HTML injection. Version 0.6.5 fixes the issue.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-07-17T14:01Z
EPSS history
Timeline
  • 17 JUL 14:01Z
    Hollo renders posts received with form elements and allows submission
    cvelistv5